Web Wiz - Green Windows Web Hosting
Web Wiz Homepage Search Web Wiz

  New Posts New Posts RSS Feed - view_last_post ERROR
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

view_last_post ERROR
 Post Reply Post Reply Page  <12
Author
  Topic Search Topic Search  Topic Options Topic Options
StarDust View Drop Down
Senior Member
Senior Member


Joined: 14 May 2007
Location: Bangladesh
Status: Offline
Points: 310 		Post Options Post Options   Thanks (0) Thanks(0)   Quote StarDust Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 7:51pm
Originally posted by Scotty32 Scotty32 wrote:

Stardust, that wouldn't be a good idea, since all 4 of his topics are related to the same issue (as Maddog stated)

Because of a failed upgrade the Last Post IDs havent been filled in, hense the Cint error.


Ow i missed your post Scotty32, sorry. Yes, you are right.
Tips, mods and skins for WWF v9.x
Back to Top
MadDog View Drop Down
Mod Builder Group
Mod Builder Group
Avatar

Joined: 01 January 2002
Status: Offline
Points: 3008 		Post Options Post Options   Thanks (0) Thanks(0)   Quote MadDog Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 8:01pm
Originally posted by StarDust StarDust wrote:

Here is a workaround

Replace Line 62 of get_last_post.asp with this:
If isNumeric(Request.QueryString("TID")) then lngTopicID = CInt(Request.QueryString("TID"))



DO NOT USE THIS CODE.

That opens the forum to SQL injection!!!!!!!!!

Redue the upgrade and make sure it works properly. DO NOT CHANGE FILES to make the forum work with an upgrade because your just going to mess it up and come back later and complain about being hacked Angry
Back to Top
StarDust View Drop Down
Senior Member
Senior Member


Joined: 14 May 2007
Location: Bangladesh
Status: Offline
Points: 310 		Post Options Post Options   Thanks (0) Thanks(0)   Quote StarDust Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 8:33pm
MadDog,

I didn't get you. Why this code opens the forum to SQL injection? 
Tips, mods and skins for WWF v9.x
Back to Top
MadDog View Drop Down
Mod Builder Group
Mod Builder Group
Avatar

Joined: 01 January 2002
Status: Offline
Points: 3008 		Post Options Post Options   Thanks (0) Thanks(0)   Quote MadDog Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 8:35pm
Because it only checks for a number, so if there is no number, there is no filter to prevent SQL injection.
Back to Top
StarDust View Drop Down
Senior Member
Senior Member


Joined: 14 May 2007
Location: Bangladesh
Status: Offline
Points: 310 		Post Options Post Options   Thanks (0) Thanks(0)   Quote StarDust Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 8:37pm
Thanks MadDog. I'll keep that in mind EVERYTIME. Thanks a lot.

What if I use this?
lngTopicID = 0
If isNumeric(Request.QueryString("TID")) then lngTopicID = CInt(Request.QueryString("TID"))
Am I safe now?
Tips, mods and skins for WWF v9.x
Back to Top
MadDog View Drop Down
Mod Builder Group
Mod Builder Group
Avatar

Joined: 01 January 2002
Status: Offline
Points: 3008 		Post Options Post Options   Thanks (0) Thanks(0)   Quote MadDog Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 8:43pm

Just add an else statement.


If isNumeric(Request.QueryString("TID")) then 
    lngTopicID = CInt(Request.QueryString("TID"))
Else
    lngTopicID = 0
End if


I personally dont see the point in adding a check for isNumeric...


lngTopicID = CInt(Request.QueryString("TID"))
Back to Top
StarDust View Drop Down
Senior Member
Senior Member


Joined: 14 May 2007
Location: Bangladesh
Status: Offline
Points: 310 		Post Options Post Options   Thanks (0) Thanks(0)   Quote StarDust Quote  Post ReplyReply Direct Link To This Post Posted: 31 July 2008 at 9:29pm
Thanks for the tip MadDog.

I guess the point in adding a check for isNumeric is when someone manually types in the URL and puts a non-numeric value CInt will course error. I need to prevent this error.
Tips, mods and skins for WWF v9.x
Back to Top
 Post Reply Post Reply Page  <12

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.

Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.